Categories: Adware

Adware:Win32/Hotbar!pz (file analysis)

The Adware:Win32/Hotbar!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Adware:Win32/Hotbar!pz virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Enumerates physical drives
Attempted to write directly to a physical drive
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Adware:Win32/Hotbar!pz?


File Info:
name: D988FD73AC7A6B42CDC8.mlwpath: /opt/CAPEv2/storage/binaries/180d0db9fe213f35c4f62a72b249f7796ef3f665c1102209e408a094ab17f7a4crc32: DF57F1C4md5: d988fd73ac7a6b42cdc8b74651fa0b5esha1: f868fb7e2398b17f343ae811117c103cc96f0094sha256: 180d0db9fe213f35c4f62a72b249f7796ef3f665c1102209e408a094ab17f7a4sha512: d1bae20ec4cfe638f09fd2d35fe514756037f447ddde95e47c9c1f52a9ec7d93254550bbac52e91139ab813527760e269a1e92eac6aa9f53c35831f5945b2ef4ssdeep: 6144:mKqQGZ33GYS29XS3FsJeYFLJ5c2uc0RWYZbOQ3+Abo:xq1Z3S2WoJtuXW1QOAbotype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1FD241393D7606CE8DE44CB70C9AEA5340138F193E598675E1BE874963E33B7A2E4701Dsha3_384: fcdce82ea9c3358067f96fe82d5328d60bab6528838b6ec134ef0f53a8ba13d52521b2668fcdf49679d9ca9f5f514fa5ep_bytes: 60be002044008dbe00f0fbff57eb0b90timestamp: 2011-06-16 04:36:23
Version Info:
FileDescription: InstallerFileVersion: 2.0.316.0ProductVersion: 2.0.316.0Translation: 0x0409 0x30ed

Adware:Win32/Hotbar!pz also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Variant.Adware.Hotbar.1
FireEye	Gen:Variant.Adware.Hotbar.1
CAT-QuickHeal	PUA.Pinballcor.Gen
Skyhigh	Adware-HotBar.f
McAfee	Adware-HotBar.f
Cylance	unsafe
Zillya	Adware.180SolutionsCRT.Win32.300
Sangfor	PUA.Win32.Sign.a
K7AntiVirus	Adware ( 00586a821 )
Alibaba	AdWare:Win32/ScreenSaver.e598ca9a
K7GW	Adware ( 00586a821 )
VirIT	Adware.Win32.Zango.HFO
Symantec	Adware.Clkpotato!gen2
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/Adware.HotBar.H
APEX	Malicious
ClamAV	Win.Trojan.Adinstall-2
Kaspersky	not-a-virus:AdWare.Win32.ScreenSaver.g
BitDefender	Gen:Variant.Adware.Hotbar.1
NANO-Antivirus	Riskware.Win32.bqt.dvtokf
SUPERAntiSpyware	PUP.HotBar/Variant
Avast	Win32:HotBar-CJ [PUP]
Tencent	Malware.Win32.Gencirc.10bf7add
Emsisoft	Gen:Variant.Adware.Hotbar.1 (B)
Baidu	Win32.Trojan.HotBar.a
F-Secure	Adware:W32/Hotbar.P
DrWeb	Adware.Hotbar.700
VIPRE	Gen:Variant.Adware.Hotbar.1
TrendMicro	TROJ_CLICKER.SMC
Sophos	Hotbar (PUA)
Ikarus	Trojan.SuspectCRC
GData	Gen:Variant.Adware.Hotbar.1
Jiangmin	AdWare.ScreenSaver.ao
Webroot	Pua.Zango
Google	Detected
Avira	ADSPY/AdSpy.Gen2
Varist	W32/HotBar.L.gen!Eldorado
Antiy-AVL	RiskWare[WebToolbar]/Win32.Zango
Kingsoft	malware.kb.b.954
Xcitium	ApplicUnwnt.Win32.AdWare.Hotbar.F@3ns6tb
Arcabit	Trojan.Adware.Hotbar.1
ZoneAlarm	not-a-virus:AdWare.Win32.ScreenSaver.g
Microsoft	Adware:Win32/Hotbar!pz
Cynet	Malicious (score: 100)
AhnLab-V3	Adware/Win32.Hotbar.R6345
VBA32	BScope.Adware.ScreenSaver
ALYac	Gen:Variant.Adware.Hotbar.1
MAX	malware (ai score=73)
Malwarebytes	Generic.Malware.AI.DDS
TrendMicro-HouseCall	TROJ_CLICKER.SMC
Rising	Trojan.Win32.Generic.14E3C42D (C64:YzY0Ovp5fRaWJlyP)
Yandex	Trojan.GenAsa!JjiYpx/LGuE
SentinelOne	Static AI – Malicious PE
MaxSecure	Adware.AdWare.WIN32.ScreenSaver.g_214906
Fortinet	Riskware/Zango
AVG	Win32:HotBar-CJ [PUP]
DeepInstinct	MALICIOUS
CrowdStrike	win/grayware_confidence_100% (D)